I know that statistical analysis of the data entering and leaving the TOR network can be used to de-anonymise users given enough time. http://www.ohmygodel.com/publications/usersrouted-ccs13.pdf
How long in practice would a 'passive adversary' have to observe the network before he could identify you? Are we talking minutes? days? weeks? And by 'adversary' i don't mean a hacker with a low boredom threshold, i mean e.g. a group with decent resources to throw at the problem. Say e.g. the FBI as a worst case in terms of a strong adversary with knowhow, expertise and resouces. And what kind of things make somebody more easy to 'cull from the herd' as a TOR user?